Fortinet FortiWeb Flaw: When SQL Injection Causes a Shell of a Problem!
Fortinet FortiWeb instances are under siege, with 85 infections spotted in one day due to a CVE-2025-25257 flaw. This remote code execution vulnerability, which triggers via SQL injection, has become a hacker’s playground. Fortinet’s advice? Upgrade faster than you can say, “SQL injection vulnerability.”
Hot Take:
Looks like Fortinet’s FortiWeb instances are making a cameo in the latest cybersecurity action thriller: “The Attack of the Killer Web Shells!” With exploits out in the wild, it’s a race against time for IT teams to patch up before their systems become the next victim of this SQL injection horror show. Who knew SQL could be so… dramatic?
Key Points:
- Multiple Fortinet FortiWeb instances were compromised via a critical RCE flaw known as CVE-2025-25257.
- The flaw is a pre-authenticated SQL injection vulnerability affecting several FortiWeb versions.
- Fortinet has released patches and urged users to upgrade to secure versions.
- Public exploits were released by WatchTowr and co-discoverer “faulty *ptrrr.”
- The Shadowserver Foundation confirmed active exploitation, affecting mainly U.S.-based endpoints.
Already a member? Log in here